This tutorial will show you how to use restic with AWS S3. It will show you how
to navigate the AWS web interface, create an S3 bucket, create a user with
access to only this bucket, and finally how to connect restic to this bucket.

You should already have a restic binary available on your system that you can
run. Furthermore, you should also have an account with
AWS. You will likely need to provide credit card
details for billing purposes, even if you use their
free-tier.

First, a bucket to store your backups in must be created. Using the “Services”
menu, navigate to S3. In case you already have some S3 buckets, you will see a
list of them here:

Click the “Create bucket” button and choose a name and region for your new
bucket. For the purpose of this tutorial, the bucket will be named
restic-demo and reside in Frankfurt. Because the bucket name space is
shared among all AWS users, the name restic-demo may not be available to
you. Be creative and choose a unique bucket name.

It is not necessary to configure any special properties or permissions of the
bucket just yet. Therefore, just finish the wizard without making any further
changes:

The newly created restic-demo bucket will now appear on the list of S3
buckets:

Use the “Services” menu of the AWS web interface to navigate to IAM. This will
bring you to the IAM homepage. To create a new user, click on the “Users” menu
entry on the left:

In case you already have set-up users with IAM before, you will see a list of
them here. Use the “Add user” button at the top to create a new user:

For this tutorial, the new user will be named restic-demo-user. Feel free to
choose your own name that best fits your needs. This user will only ever access
AWS through the restic program and not through the web interface. Therefore,
“Programmatic access” is selected for “Access type”:

During the next step, permissions can be assigned to the new user. To use this
user with restic, it only needs access to the restic-demo bucket. Select
“Attach existing policies directly”, which will bring up a list of pre-defined
policies below. Afterwards, click the “Create policy” button to create a custom
policy:

A new browser window or tab will open with the policy wizard. In Amazon IAM,
policies are defined as JSON documents. For this tutorial, the “Policy
Generator” will be used to generate a policy file using a web interface:

After invoking the policy generator, you will be presented with a user
interface to generate individual permission statements. For restic to work, two
such statements must be created. The first statement is set up as follows:

This statement allows restic to create, read and delete objects inside the S3
bucket named restic-demo. Adjust the bucket’s name to the name of the bucket
you created earlier. Using the “Add Statement” button, this statement can be
saved. Now a second statement is created:

Again, substitute restic-demo with the actual name of your bucket. Note that,
unlike before, there is no /* after the bucket name. This statement allows
restic to list the objects stored in the restic-demo bucket. Again, use “Add
Statement” to save this statement. The policy creator interface should now
look as follows:

Continue to the next step and enter a name and description for this policy. For
this tutorial, the policy will be named restic-demo-policy. In this step you
can also examine the JSON document created by the policy generator. Click
“Create Policy” to finish the process:

Go back to the browser window or tab where you were previously creating the new
user. Click the button labeled “Refresh” above the list of policies to make
sure the newly created policy is available to you. Afterwards, use the search
function to search for the restic-demo-policy. Select this policy using the
checkbox on the left. Then, continue to the next step.

The next page will present an overview of the user account that is about to be
created. If everything looks good, click “Create user” to complete the process:

After the user has been created, its access credentials will be displayed. They
consist of the “Access key ID” (think user name), and the “Secret access key”
(think password). Copy these down to a safe place.

You have now completed the configuration in AWS. Feel free to close your web
browser now.

Open a terminal and make sure you have the restic binary ready. First, choose
a password to encrypt your backups with. In this tutorial, apg is used for
this purpose:

$ apg -a 1 -m 32 -n 1 -M NCL
I9n7G7G0ZpDWA3GOcJbIuwQCGvGUBkU5

Note this password somewhere safe along with your AWS credentials. Next, the
configuration of restic will be placed into environment variables. This will
include sensitive information, such as your AWS secret and repository password.
Therefore, make sure the next commands do not end up in your shell’s
history file. Adjust the contents of the environment variables to fit your
bucket’s name and your user’s API credentials.